System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

TACACS+ servers

Updated: September 18, 2026

Want to summarize with AI?

Log in

Details TACACS+ server concepts, including server parameters, configuration procedures for hosts, group, and AAA integration, and step-by-step tasks for server authorization, authentication, and accounting.

A TACACS+ server is a remote AAA endpoint that

  • exchanges authentication, authorization, and accounting (AAA) data with Cisco IOS XR over TCP

  • supports configuration of parameters such as port, timeout, shared key, and single-connection options, and

  • is subject to global server-count limits and specific behaviors related to source interfaces.

Feature history

Table 1. Feature History Table

Feature Name

Release Information

TACACS+ Server

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-12G12X4Y-A

  • 8011-12G12X4Y-D

Additional reference information

  • By default, the TACACS+ port is standard port 49 if no other port is specified.

  • Timeout and key parameters can be configured globally or on a per-server basis.

  • The single-connection option allows all TACACS+ requests to one server to be multiplexed over a single TCP connection.

  • Cisco IOS XR supports up to 30 global TACACS+ servers.

TACACS+ server parameters

TACACS+ server parameters enable fine-tuned configuration of AAA servers for secure authentication, authorization, and accounting. Use this reference to look up parameter details before configuring individual external servers.

Port

If no port is specified, the system defaults to port 49.

Timeout and key

These parameters can be specified globally for all TACACS+ servers.

  • Timeout: Specifies how long the AAA server waits for a response from the TACACS+ server.

  • Key: Defines the authentication and encryption key shared between the AAA server and the TACACS+ server.

Single-connection

Multiplexes all TACACS+ requests to the TACACS+ server over a single TCP connection.

Single-connection idle-timeout

Specifies the timeout value for the single TCP connection.

Source-interface selection

Allows selection of the network interface for communication with the TACACS+ server.

Server limits

You can configure a maximum of 30 global TACACS+ servers.

Per-server override behavior

Parameter settings, such as shared keys, connection mode, and source-interface, can be overridden on a per-server basis.

Usage notes

Apply parameter behaviors when choosing per-server overrides, shared keys, connection mode, and source-interface settings. This ensures optimal performance and security in your AAA deployment.

Configure TACACS+ servers

Set up TACACS+ server host entries and parameters for Cisco IOS XR external AAA communication.

Use this task to configure TACACS+ server hosts, customize per-server parameters, set source-interface behavior, and verify configuration for secure external AAA communication.

Before you begin

  • Confirm network reachability to the TACACS+ server.

  • Ensure the shared authentication key matches your TACACS+ daemon.

Procedure

  1. Configure the TACACS+ server host and port.

    Example:

    Router# configure
Router(config)# tacacs-server host 209.165.200.226 port 51
Router(config-tacacs-host)#

    Specifies a TACACS+ host server and optionally specifies a server port number.

    By default, port 49 is used. Valid port numbers range from 1 to 65535.

  2. Configure the server-specific TACACS+ timeout.

    Example:

    Router(config-tacacs-host)# tacacs-server host 209.165.200.226 timeout 30

    Specifies a TACACS+ host server and optionally specifies a timeout value.

    The timeout value sets the length of time the AAA server waits to receive a response from the TACACS+ server.

    This option overrides the global timeout value set with the tacacs-server timeout command for only this server.

    The timeout value is expressed as an integer in terms of timeout interval seconds.

    The range is from 1 to 1000.

  3. Configure the shared key for the TACACS+ server.

    Example:

    Router(config)# tacacs-server host 209.165.200.226 key 0 a_secret

    Specifies a TACACS+ host server and optionally specifies an authentication and encryption key shared between the AAA server and the TACACS+ server.

    • TACACS+ packets use this key for encryption.

      This key must match the key used by the TACACS+ daemon.

      Specifying this key overrides the global key set by the tacacs-server key command for only this server.

    • (Optional) Entering 0 indicates that an unencrypted (clear-text) key follows.

    • (Optional) Entering 7 indicates that an encrypted key follows.

    • The auth-key argument specifies the encrypted or unencrypted key to be shared between the AAA server and the TACACS+ server.

  4. Configure single-connection multiplexing for the TACACS+ server.

    Example:

    Router(config)# tacacs-server host 209.165.200.226 single-connection

    Prompts the router to multiplex all TACACS+ requests to this server over a single TCP connection. By default, a separate connection is used for each session.

  5. Configure the TACACS+ single-connection idle timeout.

    Example:

    Router:hostname(config)# tacacs-server host 209.165.200.226 single-connection-idle-timeout 60

    Sets the timeout value, in seconds, for the single TCP connection to the TACACS+ server.

    The single-connection command creates the single TCP connection.

    For releases before Cisco IOS XR Software Release 7.3.2, the range is 500 to 7200 seconds.

    For Cisco IOS XR Software Release 7.3.2 and later, the range is 5 to 7200 seconds.

  6. Configure the TACACS+ source interface.

    Example:

    Router(config)# tacacs source-interface GigabitEthernet 0/4/0/0 vrf abc

    (Optional) Specifies the source IP address of a selected interface for all outgoing TACACS+ packets.

    • The specified interface or subinterface must have an IP address associated with it.

      If the specified interface or subinterface does not have an IP address or is in the down state, TACACS+ reverts to the default interface.

      Add an IP address to the interface or subinterface, or bring the interface to the up state to prevent the fallback behavior.

    • The vrf option specifies the Virtual Private Network (VPN) routing and forwarding (VRF) reference of an AAA TACACS+ server group.

  7. Repeat step 2 through step 6 for each external server to be configured.

  8. Commit or discard the configuration changes.

    Example:

    commit
end

    Use one of these options:

    • Commit: Saves the configuration changes and remains within the configuration session.

    • End: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.

    • Yes: Saves configuration changes and exits the configuration session.

    • No: Exits the configuration session without committing the configuration changes.

    • Cancel: Remains in the configuration session without committing the configuration changes.

  9. Display TACACS+ server information.

    Example:

    Router# show tacacs

    (Optional) Displays information about the TACACS+ servers that are configured in the system.

The TACACS+ server host entries are configured. You can verify the configuration and view information about the servers using the show tacacs command.

TACACS+ host, server group, and AAA configuration patterns

TACACS+ configuration reference

Host and server configuration

! Out-of-band TAC
tacacs-server host 192.0.2.10 port 49
key lm51
tacacs-server host 192.0.2.11 port 49
key lm51

Server groups

aaa group server tacacs+ tacgrp
 server 192.0.2.10
 server 192.0.2.11

aaa group server tacacs+ eem
 server 192.0.2.10
 server 192.0.2.11

AAA authorization and authentication

aaa authorization exec tacauthen group tacgrp local
aaa authentication login taclogin group tacgrp local

Console line settings

line console
 authorization exec tacauthen
 login authentication taclogin
 timeout login response 30
 timestamp
 exec-timeout 0 0
 session-timeout 15

VTY pool settings

vty-pool default 0 99 line-template console

Usage guidelines

  • Use these configuration patterns as a compact reference for setting up TACACS+ hosts, server groups, AAA authorization, login authentication, and line/vty-pool settings.

  • Adapt addresses, keys, method-list names, and line settings to match your deployment.

  • Refer to this reference for quick access to common TACACS+ setup components.

Configure TACACS+ server authorization

Configure TACACS+ authorization so that an authenticated user or principal is checked for permission to perform a task.

Configure remote command authorization through TACACS+, enable ConfD authorization and callbacks, and commit the settings that control command authorization checks.

Before you begin

Configure the TACACS+ server and AAA server-group design before enabling remote authorization.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Configure TACACS+ command authorization.

    Example:

    Router(config)# aaa authorization command group tacacs

    Example:

    Router(config)# aaa authorization command group none

    Example:

    Router(config)# aaa authorization command group tacacs none

    Configure the AAA system to perform remote authorization using TACACS+ protocol.

    Configure the AAA system to not perform any authorization.

    Configure the AAA system to first perform TACACS+ authorization and if it fails, no authorization should be performed.

  3. Enable remote authorization in ConfD.

    Example:

    Router(config)# confdConfig aaa authorization enabled

    Configure ConfD to perform remote authorization.

  4. Enable authorization callbacks in ConfD.

    Example:

    Router(config)# confdConfig aaa authorization callback enabled

    Configure ConfD to invoke application callbacks for authorization.

  5. Commit or discard the configuration changes.

    Example:

    commit
end

    Use one of these options:

    • Commit: Saves the configuration changes and remains within the configuration session.

    • End: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.

    • Yes: Saves configuration changes and exits the configuration session.

    • No: Exits the configuration session without committing the configuration changes.

    • Cancel: Remains in the configuration session without committing the configuration changes.

The AAA system and ConfD are configured for TACACS+ authorization behavior.

Configure TACACS+ server authentication

Set up external authentication in ConfD, allowing TACACS+ to verify user or principal identities.

Use this task to configure ConfD for external authentication via TACACS+, control the authentication order, and specify the executable for authentication on your Cisco device.

Before you begin

  • Ensure TACACS+ server connectivity is established.

  • Confirm the local login proxy executable path on the device.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Enable external authentication in ConfD.

    Example:

    Router(config)# confdConfig aaa externalAuthentication enabled

    Configure ConfD to perform external authentication.

  3. Configure the ConfD authentication order.

    Example:

    Router(config)# confdConfig aaa authOrder externalAuthentication localAuthentication

    Configure the AAA subsystem to perform external authentication first and then local authentication.

  4. Configure the external authentication executable in ConfD.

    Example:

    Router(config)# confdConfig aaa externalAuthentication executable chvrf 0 /opt/cisco/calvados/bin/calvados_login_aaa_proxy

    Configure the AAA system to perform external authentication using login executable configured on local host.

  5. Commit or discard the configuration changes.

    Example:

    commit
end

    Use one of these options:

    • Commit: Saves the configuration changes and remains within the configuration session.

    • End: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.

    • Yes: Saves configuration changes and exits the configuration session.

    • No: Exits the configuration session without committing the configuration changes.

    • Cancel: Remains in the configuration session without committing the configuration changes.

ConfD is configured to use TACACS+ server authentication according to your specified authentication order and settings.

Configure TACACS+ server accounting

Enable remote command accounting so TACACS+ records command activity on the router for audit and operational review.

TACACS+ command accounting allows Cisco IOS XR to log both user-generated and system-generated commands, providing a comprehensive record for security audits and troubleshooting.

Before you begin

Ensure the TACACS+ server is configured before enabling command accounting.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Configure TACACS+ command accounting.

    Example:

    Router(config)# aaa accounting command tacacs

    Configure remote accounting commands.

  3. Save or discard the configuration changes.

    Use one of these options:

    • Commit: Saves the configuration changes and remains within the configuration session.

    • End: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.

    • Yes: Saves configuration changes and exits the configuration session.

    • No: Exits the configuration session without committing the configuration changes.

    • Cancel: Remains in the configuration session without committing the configuration changes.

TACACS+ command accounting is configured and committed on the router.